Description:
------------
The example on http://docs.php.net/escapeshellcmd is wrong:

<?php
// here we don't care if $e has spaces
system("echo $e");
$f = escapeshellcmd($filename);
 
// and here we do, so we use quotes
system("touch \"/tmp/$f\"; ls -l \"/tmp/$f\"");
?>

- Escapeshellcmd is meant to be used without quotes
- Adding quotes around an escaped string doesn't prevent it from being interpreted as multiple arguments by the shell:

printf('touch "/tmp/%s"', escapeshellcmd('foo" "bar'));

Result:

touch "/tmp/foo" "bar" // two arguments

The correct way of escaping an argument is to use escapeshellarg():

printf('touch /tmp/%s', escapeshellarg('foo" "bar'));

Result:

touch /tmp/'foo" "bar' // one argument

I think the second part of the example should be removed, and a warning should be added:

The string may be interpreted as multiple arguments, use escapeshellarg instead.


Related reports: https://bugs.php.net/bug.php?id=47694